Zonemaster is an Open source DNS validation tool

Source: https://github.com/zonemaster/zonemaster
Hosted: https://www.zonemaster.net/domain_check

Install Perl modules

Dependencies:

cpanm File::ShareDir cpanm File::Slurp Hash::Merge IO::Socket::INET6 List::MoreUtils Mail::RFC822::Address Module::Find Moose Net::IP Readonly::XS Text::CSV Devel::CheckLib

Zonemaster LDNS and Engine:

cpanm Zonemaster::LDNS
cpanm Zonemaster::Engine

Test

time perl -MZonemaster::Engine -e 'print map {"$_\n"} Zonemaster::Engine->test_module("BASIC", "zonemaster.net")'

Install Perl modules

Dependencies:

cpanm MooseX::Getopt Text::Reflow Module::Install

Zonemaster CLI:

cpanm Zonemaster::CLI

Examples

zonemaster-cli --test basic zonemaster.net
zonemaster-cli --no-ipv6 --show_level --show_module --progress --level INFO --test Syntax example.com

How to use SysRq (Print Screen key)

( “REISUB” )

enable:

echo 1 > proc/sys/kernel/sysrq

permanently:

/etc/sysctl.d/local.conf
kernel.sysrq=1

To BREAK: CTRL+PAUSE (Serial)

ALT+SysReq+KEY
When logged in using SSH the SysRq may be accessible by writing to /proc/sysrq-trigger
echo s > /proc/sysrq-trigger

useful options:

• b: Immediately reboot the system, without unmounting or syncing filesystems
  echo b > proc/sysrq-trigger
• e: Send the SIGTERM signal to all processes except init (PID 1)
• f: Call oom_kill, which kills a process to alleviate an OOM condition:
• s: Sync all mounted filesystems:
• t: Output a list of current tasks and their information to the console:
• u: Remount all mounted filesystems in read-only mode
• w: Display list of blocked (D state) tasks
• space: Print a summary of available magic SysRq keys

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/Documentation/admin-guide/sysrq.rst
https://en.wikipedia.org/wiki/Magic_SysRq_key

perf – performance analysis tools for Linux

Start with:

perf top
perf bench all

Example:

To find out why “kworker” process (kernel per-cpu threads) has high CPU usage:

• record 10 seconds of backtraces on all CPUs to perf.data:
  perf record -g -a sleep 10

• analyse recording:
  perf report

More info:
https://www.brendangregg.com/perf.html
https://askubuntu.com/questions/33640/kworker-what-is-it-and-why-is-it-hogging-so-much-cpu

Remote upgrade using aptitude:

1. echo “defscrollback 10000” >>/root/.screenrc
2. screen
3. /etc/sysctl.conf:
   # on kernel panic reboot after 60s
kernel.panic = 600
# enable magic sysrq key
kernel.sysrq=1</pre>
4. In /etc/apt/sources.list: change old to new dist (or “stable” etc)
   ( if needed: apt-get install debian-archive-keyring )
5. aptitude update
6. aptitude safe-upgrade
   ( optionally/if needed: full-upgrade, dist-upgrade )

Change default editor:

sudo update-alternatives --config editor

Install build tools:

apt-get install build-essential

pkg install dates:

for file_list in `ls -rt /var/lib/dpkg/info/*.list`; do \
  stat_result=$(stat --format=%y "$file_list"); \
  printf "%-50s %s\n" $(basename $file_list .list) "$stat_result"; \
done

backports:
apt-get -t stretch-backports install “package”

aptitude -t stretch-backports install “package”
/etc/apt/preferences:
Package: *
Pin: release a=stable
Pin-Priority: 900

Package: *
Pin: release o=Debian
Pin-Priority: -10

“testing” packages:
install a pkg from testing:

sudo apt-get -t testing install tmux

show all testing pkgs:

aptitude search -F "%p %V %v" '?narrow(~i, ~Atesting)

( stable, unstable, oldstable, etc )
apt-get install package=version
				

When trying to ping as non root user you might get the following error:

ping: icmp open socket: Operation not permitted

There are several ways to fix this:

reinstall pkg (debian):

$ sudo apt-get install --reinstall iputils-ping

(sets cap)

manually set cap:

$ sudo setcap cap_net_raw+ep /bin/ping
$ sudo setcap cap_net_raw+ep /bin/ping6
$ sudo getcap /bin/ping
$ sudo getcap /bin/ping6

needs kernel config:
CONFIG_EXT4_FS_SECURITY=y

dont use SOCK_RAW:

socket(PF_INET, SOCK_DGRAM, PROT_ICMP)

$ cat /proc/sys/net/ipv4/ping_group_range
$ sysctl net.ipv4.ping_group_range

• “1 0” default, nobody except root
• “100 100” single group
• “0 2147483647” everyone (max gid)

$ sysctl net.ipv4.ping_group_range = "0 2147483647"


/etc/sysctl.d/local.conf
net.ipv4.ping_group_range=0 2147483647


suid:

chmod +s /usr/ping
chmod +s /usr/ping6

First make sure “auditd” is started

add rules:

auditctl -a always,exit -S all -F path=/etc/passwd -F key=config1
auditctl -w /etc/passwd -p rwa -k config2

del rules:

auditctl -d always,exit -S all -F path=/etc/passwd -F key=config1
auditctl -W /etc/passwd -p rwa -k config2

(or restart auditd)

make permanent:

add rules to /etc/audit/rules.d/audit.rules

show results:

ausearch -ts today -k config1
aureport -k

disable audit logs:

systemctl mask systemd-journald-audit.socket

Quickfix issues

Restart:

gnome-keyring-daemon -r -d

If that doesn’t suffice, this extra steps might help:

pgrep -f gnome-keyring-daemon
rm -rf ~/.cache/keyring-*
setsid /usr/bin/gnome-keyring-daemon /dev/null 2>&1
ln -s ~/.cache/keyring-* $GNOME_KEYRING_CONTROLA
/usr/bin/gnome-keyring-daemon --start --components=pkcs11
/usr/bin/gnome-keyring-daemon --start --components=gpg
/usr/bin/gnome-keyring-daemon --start --components=ssh

find ~/.cache/ -maxdepth 1 -type l -name 'keyring-*' -delete